This policy explains how we collect, use, and disclose your personal data when you shop at this store, in line with the Personal Data Protection Act 2012 (PDPA). It describes what this store actually does, not every use the law would allow.
1. Who we are
This store is operated by the company below, which is responsible for your personal data under the PDPA.
| Legal entity | Palmonyx Pte. Ltd. |
|---|---|
| Registered address | 600 North Bridge Road, #11-08 Parkview Square, Singapore 188778 |
| UEN | 202313635G |
| Official phone | +65 8552 6029 |
Our Data Protection Officer can be reached at info@terromarket.com. Write to that address for any request in this policy.
2. The personal data we collect
| Data | What it is | Where it comes from |
|---|---|---|
| Account | Name, email address, password (stored only as a one-way hash), date of registration | You, when you register |
| Delivery | Recipient name, phone number, delivery address, postcode | You, at checkout or in your account |
| Orders | Items, amounts, order number, payment status and reference | Created when you place an order |
| Verification | One-time codes sent to your email and when they were sent | Created when you verify your email |
| Account activity | Wishlist, notifications, saved addresses | Created when you use those features |
| Technical | IP address, browser type, pages visited, time of visit | Sent by your browser |
| Messages | What you write to us by email, WhatsApp, or the contact form | You |
We never receive or store your card number, CVV, or banking credentials. Payment happens on the 2C2P payment page; we receive only whether it succeeded and its reference.
We do not ask for your NRIC or FIN number, and you should not send it to us.
3. Why we use it
- To sell and deliver your order, take payment, handle returns and warranty claims, and keep the records the law requires.
- To run your account: sign-in, saved addresses, wishlist, and notifications you asked for.
- To protect the store: verifying email at checkout, limiting sign-in attempts, and investigating fraud.
- To remember your choices on this device, only if you allow it under Privacy choices.
- To count visits in aggregate, only if you allow it under Privacy choices.
- To send our newsletter, only if you subscribe and confirm your subscription by email.
We do not sell personal data, build advertising profiles, or make decisions about you by automated means alone. We do not send marketing messages to Singapore telephone numbers.
4. Who we share it with
- 2C2P, our payment provider, receives the order number, amount, and your name, email address, and phone number to process the payment.
- Couriers receive the recipient name, address, and phone number needed to deliver the parcel.
- Cloudflare (Turnstile) checks that the contact and newsletter forms are filled in by a person, using your IP address and browser details, only once you start filling in one of those forms. Cloudflare also uses those signals for its own bot detection, under its own privacy policy.
- WhatsApp (Meta), if you choose to contact us there. That conversation is subject to Meta’s own policy.
- Our hosting and email providers, who store and send data on our instructions.
- Authorities, where the law requires it.
5. Transfers outside Singapore
Some of your data is processed outside Singapore: by the providers above. Where we transfer personal data overseas, we take steps to ensure it receives protection comparable to the PDPA, as the Transfer Limitation Obligation requires.
6. How long we keep it
| Data | How long |
|---|---|
| Order and payment records | As long as the Companies Act, the Income Tax Act, and the GST Act require |
| Account, saved addresses, wishlist, notifications | While your account is open |
| One-time codes | Minutes; they expire after use |
| Security log with IP addresses | 30 days, then deleted automatically |
| Visit counts | Kept only as daily totals, with no identifier that can be reversed |
| Newsletter subscription | Until you unsubscribe |
When you delete your account, the data tied to you is deleted. Order records are kept for the period above but are detached from your identity.
7. Your choices and rights
You can do the following yourself, at any time:
- Correct your data: sign in and open Profile and Delivery addresses.
- Withdraw consent for cookies: Privacy choices, at the bottom of every page. What was stored under that consent is removed from your browser at once.
- Unsubscribe: the link in every newsletter.
- Get a copy of your data: your account, Settings. The copy is emailed to your account address in an open format.
- Delete your account: your account, Settings.
You may also ask us for access to your personal data and how it has been used or disclosed in the past year, ask us to correct it, or withdraw consent for any use, by writing to info@terromarket.com. We respond as soon as reasonably possible and, for access requests, within 30 days or tell you when we will. If you withdraw consent, we tell you what that means for the service before acting on it.
8. How we protect it
- All traffic to the store is encrypted.
- Passwords are stored only as hashes that we cannot read.
- Production payment credentials are never stored in the database.
- Access to customer data is limited to the staff who need it.
- Verification and registration requests are rate-limited.
If a data breach is likely to cause you significant harm, or affects 500 or more people, we notify the Personal Data Protection Commission within 3 calendar days of assessing it, and notify affected individuals as the PDPA requires.
9. Children
This store is not intended for children. If you are a parent or guardian and believe a child has given us personal data, write to info@terromarket.com and we will delete it.
10. Changes and complaints
When this policy changes, the review date at the top of the page changes with it. If you are not satisfied with how we handled a request, write to us first; you may also contact the Personal Data Protection Commission.
This policy is governed by the laws of Singapore.